Newshot Article Title: US Freezes $2.7 Billion in Binance Assets Stolen by North Korean Hackers, Total Involved Reaches $6 Billion
Body:
US Freezes $2.7 Billion in Binance Heist, Targets North Korean Hacker Group
The US government has frozen $2.7 billion of the cryptocurrency stolen from Binance around October 29, 2026. The FBI stated that North Korea stole more than $6 billion in crypto assets in this theft.
A court has now issued an order authorizing US officials to seize or retain more than $1.2 billion of the frozen funds. The US Department of Justice announced this enforcement action on November 12, while also announcing a separate crackdown on a North Korean fraud campaign called FaceStealer.
The FBI has identified a North Korean hacking group tracked as TraderTraitor as the mastermind behind the Binance theft. According to earlier reports, the bureau linked the case to North Korea within days of the incident.
The FBI, the Secret Service, and the IRS Criminal Investigation division stated that the attackers are converting most of the stolen funds into Ethereum and plan to move the funds through DeFi tools and instant exchange services to obscure the money trail.
The US Department of Justice said its National Security Division, Criminal Division, and the US Attorney's Office for the District of Columbia, together with cryptocurrency service providers, have blocked the illicit transfer of funds.
Officials said the attackers are still moving funds through cross-chain bridges, mixers, and exchanges. The FBI has asked all service providers to block all transfers associated with the addresses used by the hackers.
Binance officially stated that all user losses have been fully reimbursed. Reports say the exchange covered the entire loss through its SAFU emergency fund. Preliminary investigations show the intrusion began with a laptop used by an engineer, which had been compromised by the attackers.
Parallel Crackdown on FaceStealer Fraud Involving Over $400 Million
The US Department of Justice emphasized that FaceStealer is a separate fraud campaign unrelated to the Binance theft. FBI data shows the campaign has caused over $400 million in losses to victims within 18 months.
The FBI has identified multiple tracked North Korean hacking groups as involved in the fraud campaign, including Sapphire Sleet, UNC1069, BlueNoroff, APT38, and Stardust Chollima. Law enforcement has seized the cloud servers used in the campaign, along with more than 900 private webcam videos of victims secretly recorded by the hackers.
Fake Video Calls as Attack Entry Point, Targets Now Extend to Open Source Maintainers
These attacks typically begin with a stolen Telegram account. The hackers send messages to contacts in the account, inviting them to a video call. Once the person agrees, the hackers send a link posing as the Zoom or Teams website. After the victim enters the link, they see a pre-recorded video of an acquaintance and believe the call is genuine.
The campaign fabricates fake meeting audio failure prompts to trick victims into installing cookie stealers, keyloggers, screen capture tools, and backdoors. The webcam footage secretly recorded by the attackers is then used in subsequent fake meeting phishing. Some attacks use AI-generated deepfake videos of well-known figures in the crypto space, but the FBI says the scam still mainly relies on secretly recorded real videos. After a successful breach, the hackers do not steal funds immediately; they often lie dormant for months or even over a year, watching wallet balances grow and waiting for the right moment to drain the wallets.
The FBI warns that this attack technique now lists open source maintainers as targets. Earlier this year, hackers used fake Teams calls as bait to phish a maintainer of a popular JavaScript library, infecting the person's device. The attackers then attempted to plant a malicious dependency into the codebase, which is downloaded tens of millions of times per week; timely discovery prevented harm. This is not an isolated case. Previously published reports show that when the UNC1069 group carried out attacks using fake Zoom and Teams meetings, it used the same tactics of fake error prompts and copy-paste execution steps.
The FBI's protection recommendations are clear. When joining a meeting, enter the invitation code through the official Zoom or Teams client, and do not click links; do not turn on your camera until you have confirmed you can see and hear the person inviting you. Never paste and execute any command into a terminal to fix a meeting issue.
Users should verify the authenticity of meeting invitations through a second channel and enable multi-factor authentication for Telegram, Slack, and similar apps. Keep only a small amount of funds in browser wallets, and never store seed phrases on your device.
If you suspect you have been attacked, immediately transfer funds to a new wallet on an uninfected, secure device, then change all related passwords and log out of all account sessions. After handling the incident, promptly alert your contacts and submit a report at IC3.gov with the keyword "FaceStealer".
This asset freeze operation demonstrates that rapid response can effectively intercept stolen funds. The FaceStealer cases also serve as a reminder that a single convincing video call can become the starting point for the next large-scale theft.
US Freezes $2.7 Billion Stolen by North Korean Hackers in Massive $6 Billion Binance Crypto Heist